Regional firewall clustering in a networked computing environment

ABSTRACT

An approach for regional firewall clustering for optimal state-sharing of different sites in a virtualized/networked (e.g., cloud) computing environment is provided. In a typical embodiment, each firewall in a given region is informed of its peer firewalls via a registration process with a centralized server. Each firewall opens up an Internet protocol (IP)-based communication channel to each of its peers in the region to share state table information. This allows for asymmetrical firewall flows through the network and allows routing protocols to ascertain the best path to a given destination without having to take firewall placement into consideration.

CROSS-REFERENCE TO RELATED APPLICATIONS

The present patent document is a continuation of U.S. patent applicationSer. No. 13/913,022, filed Jun. 7, 2013, entitled “REGIONAL FIREWALLCLUSTERING IN A NETWORKED COMPUTING ENVIRONMENT”, the disclosure ofwhich is incorporated herein by reference.

TECHNICAL FIELD

In general, embodiments of the present invention relate to computernetworking. Specifically, embodiments of the present invention relate tomanaging packet flow between firewalls in a networked computingenvironment (e.g., a cloud computing environment).

BACKGROUND

Computers are valuable tools in large part for their ability tocommunicate with other computer systems and retrieve information overcomputer networks. Networks typically comprise an interconnected groupof computers, linked by wire, fiber optic, radio, or other datatransmission means, to provide the computers with the ability totransfer information from computer to computer. The Internet is perhapsthe best-known computer network and enables millions of people to accessmillions of other computers such as by viewing web pages, sendinge-mail, or by performing other computer-to-computer communication.

But, because the size of the Internet is so large and Internet users areso diverse in their interests, it is not uncommon for malicious users toattempt to communicate with other users' computers in a manner thatposes a danger to the other users. For that reason, many corporations,institutions, and even home users use a network firewall or similardevice between their local network and the Internet. The firewall istypically a computerized network device that inspects network trafficthat passes through it, permitting passage of desired network trafficbased on a set of rules. Firewalls perform their filtering functions byobserving communication packets, such as TCP/IP or other networkprotocol packets, and examining characteristics such as the source anddestination of network addresses, what ports are being used, and thestate or history of the connection. Some firewalls also examine packetstraveling to or from a particular application, or act as a proxy deviceby processing and forwarding selected network requests between aprotected user and external networked computers.

SUMMARY

Embodiments described herein provide an approach for regional firewallclustering for optimal state-sharing of different sites in avirtualized/networked (e.g., cloud) computing environment. In a typicalembodiment, each firewall in a given region is informed of its peerfirewalls via a registration process with a centralized server. Eachfirewall opens up an Internet protocol (IP)-based communication channelto each of its peers in the region to share state table information.This allows for asymmetrical firewall flows through the network andallows routing protocols to ascertain the best path to a givendestination without having to take firewall placement intoconsideration.

A first aspect provides a method for managing a firewall cluster in anetworked computing environment, comprising the computer-implementedsteps of: receiving a packet at a first firewall in the firewall clusterbetween a source and a destination, wherein the packet has an unknownsession state; reading a session state table to determine a sessionstate match based on the source and destination; buffering the packetfor the duration of a predefined time interval when a session statematch is not found; and forwarding the packet to the destination whensession state information is received from a second firewall in thefirewall cluster prior to the expiration of the predefined timeinterval.

A second aspect provides a system for managing a firewall cluster in anetworked computing environment, comprising: a first firewall in thefirewall cluster configured to receive a packet from a source intendedfor a destination, wherein the packet has an unknown session state; acluster synchronization server configured to store a session statetable; the first firewall further configured to read the session statetable to determine a session state match based on the source anddestination; the first firewall further configured to buffer the packetfor the duration of a predefined time interval when a session statematch is not found; and the first firewall further configured to forwardthe packet to the destination when session state information is receivedfrom a second firewall in the firewall cluster prior to the expirationof the predefined time interval.

A third aspect provides computer program product for managing a firewallcluster in a networked computing environment, the computer programproduct comprising a computer readable storage media, and programinstructions stored on the computer readable storage media, to: receivea packet at a firewall between a source and a destination, wherein thepacket has an unknown session state; read a session state table todetermine a session state match based on the source and destination;buffer the packet for the duration of a predefined time interval when asession state match is not found; and forward the packet to thedestination when session state information is received prior to theexpiration of the predefined time interval.

BRIEF DESCRIPTION OF THE DRAWINGS

These and other features of this invention will be more readilyunderstood from the following detailed description of the variousaspects of the invention taken in conjunction with the accompanyingdrawings in which:

FIG. 1 depicts a cloud computing node according to an embodiment of thepresent invention;

FIG. 2 depicts a cloud computing environment according to an embodimentof the present invention;

FIG. 3 depicts abstraction model layers according to an embodiment ofthe present invention;

FIG. 4 depicts an architectural diagram showing asymmetric packet flowin a stateless firewall filter configuration;

FIG. 5 depicts an architectural diagram according to an embodiment ofthe present invention;

FIG. 6 depicts a method flow diagram for determining a cluster delayinterval according to an embodiment of the present invention;

FIG. 7 depicts an architectural diagram showing multi-pathing accordingto an embodiment of the present invention; and

FIG. 8 depicts a method flow diagram according to an embodiment of thepresent invention.

The drawings are not necessarily to scale. The drawings are merelyschematic representations, not intended to portray specific parametersof the invention. The drawings are intended to depict only typicalembodiments of the invention, and therefore should not be considered aslimiting the scope of the invention. In the drawings, like numberingrepresents like elements.

DETAILED DESCRIPTION

Illustrative embodiments will now be described more fully herein withreference to the accompanying drawings. This disclosure may, however, beembodied in many different forms and should not be construed as limitedto the embodiments set forth herein. Rather, these embodiments areprovided so that this disclosure will be thorough and complete and willfully convey the scope of this disclosure to those skilled in the art.In the description, details of well-known features and techniques may beomitted to avoid unnecessarily obscuring the presented embodiments.

The terminology used herein is for the purpose of describing particularembodiments only and is not intended to be limiting of this disclosure.As used herein, the singular forms “a”, “an”, and “the” are intended toinclude the plural forms as well, unless the context clearly indicatesotherwise. Furthermore, the use of the terms “a”, “an”, etc., do notdenote a limitation of quantity, but rather denote the presence of atleast one of the referenced items. The term “set” is intended to mean aquantity of at least one. It will be further understood that the terms“comprises” and/or “comprising”, or “includes” and/or “including”, whenused in this specification, specify the presence of stated features,regions, integers, steps, operations, elements, and/or components, butdo not preclude the presence or addition of one or more other features,regions, integers, steps, operations, elements, components, and/orgroups thereof. As used herein, the term “region” refers to any area ordivision of a networked computing environment having definablecharacteristics and/or fixed boundaries.

As indicated above, approaches for packet flow management betweenfirewalls in a virtualized/networked (e.g., cloud) computing environmentare provided. In a typical embodiment, historical command usage within aserver environment is analyzed to determine the characteristics of thecommands being run against a cloud resource to determine with aconfidence rating the likelihood the commands are being executed by acertain user. Such an approach allows for more efficient user identitymanagement in order to optimize cloud security and systemadministration.

It is understood in advance that although this disclosure includes adetailed description of cloud computing, implementation of the teachingsrecited herein are not limited to a cloud computing environment. Rather,embodiments of the present invention are capable of being implemented inconjunction with any other type of computing environment now known orlater developed.

Cloud computing is a model of service delivery for enabling convenient,on-demand network access to a shared pool of configurable computingresources (e.g. networks, network bandwidth, servers, processing,memory, storage, applications, virtual machines, and services) that canbe rapidly provisioned and released with minimal management effort orinteraction with a provider of the service. This cloud model may includeat least five characteristics, at least three service models, and atleast four deployment models.

Characteristics are as follows:

On-demand self-service: a cloud consumer can unilaterally provisioncomputing capabilities, such as server time and network storage, asneeded, automatically without requiring human interaction with theservice's provider.

Broad network access: capabilities are available over a network andaccessed through standard mechanisms that promote use by heterogeneousthin or thick client platforms (e.g., mobile phones, laptops, and PDAs).

Resource pooling: the provider's computing resources are pooled to servemultiple consumers using a multi-tenant model, with different physicaland virtual resources dynamically assigned and reassigned according todemand. There is a sense of location independence in that the consumergenerally has no control or knowledge over the exact location of theprovided resources but may be able to specify location at a higher levelof abstraction (e.g., country, state, or datacenter).

Rapid elasticity: capabilities can be rapidly and elasticallyprovisioned, in some cases automatically, to quickly scale out andrapidly released to quickly scale in. To the consumer, the capabilitiesavailable for provisioning often appear to be unlimited and can bepurchased in any quantity at any time.

Measured service: cloud systems automatically control and optimizeresource use by leveraging a metering capability at some level ofabstraction appropriate to the type of service (e.g., storage,processing, bandwidth, and active consumer accounts). Resource usage canbe monitored, controlled, and reported providing transparency for boththe provider and consumer of the utilized service.

Service Models are as follows:

Software as a Service (SaaS): the capability provided to the consumer isto use the provider's applications running on a cloud infrastructure.The applications are accessible from various client devices through athin client interface such as a web browser (e.g., web-based email). Theconsumer does not manage or control the underlying cloud infrastructureincluding network, servers, operating systems, storage, or evenindividual application capabilities, with the possible exception oflimited consumer-specific application configuration settings.

Platform as a Service (PaaS): the capability provided to the consumer isto deploy onto the cloud infrastructure consumer-created or acquiredapplications created using programming languages and tools supported bythe provider. The consumer does not manage or control the underlyingcloud infrastructure including networks, servers, operating systems, orstorage, but has control over the deployed applications and possiblyapplication-hosting environment configurations.

Infrastructure as a Service (IaaS): the capability provided to theconsumer is to provision processing, storage, networks, and otherfundamental computing resources where the consumer is able to deploy andrun arbitrary software, which can include operating systems andapplications. The consumer does not manage or control the underlyingcloud infrastructure but has control over operating systems, storage,deployed applications, and possibly limited control of select networkingcomponents (e.g., host firewalls).

Deployment Models are as follows:

Private cloud: the cloud infrastructure is operated solely for anorganization. It may be managed by the organization or a third party andmay exist on-premises or off-premises.

Community cloud: the cloud infrastructure is shared by severalorganizations and supports a specific community that has shared concerns(e.g., mission, security requirements, policy, and complianceconsiderations). It may be managed by the organizations or a third partyand may exist on-premises or off-premises.

Public cloud: the cloud infrastructure is made available to the generalpublic or a large industry group and is owned by an organization sellingcloud services.

Hybrid cloud: the cloud infrastructure is a composition of two or moreclouds (private, community, or public) that remain unique entities butare bound together by standardized or proprietary technology thatenables data and application portability (e.g., cloud bursting forload-balancing between clouds).

A cloud computing environment is service oriented with a focus onstatelessness, low coupling, modularity, and semantic interoperability.At the heart of cloud computing is an infrastructure comprising anetwork of interconnected nodes.

Referring now to FIG. 1, a schematic of an example of a cloud computingnode is shown. Cloud computing node 10 is only one example of a suitablecloud computing node and is not intended to suggest any limitation as tothe scope of use or functionality of embodiments of the inventiondescribed herein. Regardless, cloud computing node 10 is capable ofbeing implemented and/or performing any of the functionality set forthhereinabove.

In cloud computing node 10, there is a computer system/server 12, whichis operational with numerous other general purpose or special purposecomputing system environments or configurations. Examples of well-knowncomputing systems, environments, and/or configurations that may besuitable for use with computer system/server 12 include, but are notlimited to, personal computer systems, server computer systems, thinclients, thick clients, hand-held or laptop devices, multiprocessorsystems, microprocessor-based systems, set top boxes, programmableconsumer electronics, network PCs, minicomputer systems, mainframecomputer systems, and distributed cloud computing environments thatinclude any of the above systems or devices, and the like.

Computer system/server 12 may be described in the general context ofcomputer system-executable instructions, such as program modules, beingexecuted by a computer system. Generally, program modules may includeroutines, programs, objects, components, logic, data structures, and soon that perform particular tasks or implement particular abstract datatypes. Computer system/server 12 may be practiced in distributed cloudcomputing environments where tasks are performed by remote processingdevices that are linked through a communications network. In adistributed cloud computing environment, program modules may be locatedin both local and remote computer system storage media including memorystorage devices.

As shown in FIG. 1, computer system/server 12 in cloud computing node 10is shown in the form of a general-purpose computing device. Thecomponents of computer system/server 12 may include, but are not limitedto, one or more processors or processing units 16, a system memory 28,and a bus 18 that couples various system components including systemmemory 28 to processor 16.

Bus 18 represents one or more of any of several types of bus structures,including a memory bus or memory controller, a peripheral bus, anaccelerated graphics port, and a processor or local bus using any of avariety of bus architectures. By way of example, and not limitation,such architectures include Industry Standard Architecture (ISA) bus,Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, VideoElectronics Standards Association (VESA) local bus, and PeripheralComponent Interconnects (PCI) bus.

Computer system/server 12 typically includes a variety of computersystem readable media. Such media may be any available media that isaccessible by computer system/server 12, and it includes both volatileand non-volatile media, removable and non-removable media.

System memory 28 can include computer system readable media in the formof volatile memory, such as random access memory (RAM) 30 and/or cachememory 32. Computer system/server 12 may further include otherremovable/non-removable, volatile/non-volatile computer system storagemedia. By way of example only, storage system 34 can be provided forreading from and writing to a non-removable, non-volatile magnetic media(not shown and typically called a “hard drive”). Although not shown, amagnetic disk drive for reading from and writing to a removable,non-volatile magnetic disk (e.g., a “floppy disk”), and an optical diskdrive for reading from or writing to a removable, non-volatile opticaldisk such as a CD-ROM, DVD-ROM, or other optical media can be provided.In such instances, each can be connected to bus 18 by one or more datamedia interfaces. As will be further depicted and described below,memory 28 may include at least one program product having a set (e.g.,at least one) of program modules that are configured to carry out thefunctions of embodiments of the invention.

The embodiments of the invention may be implemented as a computerreadable signal medium, which may include a propagated data signal withcomputer readable program code embodied therein (e.g., in baseband or aspart of a carrier wave). Such a propagated signal may take any of avariety of forms including, but not limited to, electro-magnetic,optical, or any suitable combination thereof. A computer readable signalmedium may be any computer readable medium that is not a computerreadable storage medium and that can communicate, propagate, ortransport a program for use by or in connection with an instructionexecution system, apparatus, or device.

Program code embodied on a computer readable medium may be transmittedusing any appropriate medium including, but not limited to, wireless,wireline, optical fiber cable, radio-frequency (RF), etc., or anysuitable combination of the foregoing.

Program/utility 40, having a set (at least one) of program modules 42,may be stored in memory 28 by way of example, and not limitation. Memory28 may also have an operating system, one or more application programs,other program modules, and program data. Each of the operating system,one or more application programs, other program modules, and programdata or some combination thereof, may include an implementation of anetworking environment. Program modules 42 generally carry out thefunctions and/or methodologies of embodiments of the invention asdescribed herein.

Computer system/server 12 may also communicate with one or more externaldevices 14 such as a keyboard, a pointing device, a display 24, etc.;one or more devices that enable a consumer to interact with computersystem/server 12; and/or any devices (e.g., network card, modem, etc.)that enable computer system/server 12 to communicate with one or moreother computing devices. Such communication can occur via I/O interfaces22. Still yet, computer system/server 12 can communicate with one ormore networks such as a local area network (LAN), a general wide areanetwork (WAN), and/or a public network (e.g., the Internet) via networkadapter 20. As depicted, network adapter 20 communicates with the othercomponents of computer system/server 12 via bus 18. It should beunderstood that although not shown, other hardware and/or softwarecomponents could be used in conjunction with computer system/server 12.Examples include, but are not limited to: microcode, device drivers,redundant processing units, external disk drive arrays, RAID systems,tape drives, and data archival storage systems, etc.

Referring now to FIG. 2, illustrative cloud computing environment 50 isdepicted. As shown, cloud computing environment 50 comprises one or morecloud computing nodes 10 with which local computing devices used bycloud consumers, such as, for example, personal digital assistant (PDA)or cellular telephone 54A, desktop computer 54B, laptop computer 54C,and/or automobile computer system 54N may communicate. Nodes 10 maycommunicate with one another. They may be grouped (not shown) physicallyor virtually, in one or more networks, such as private, community,public, or hybrid clouds as described hereinabove, or a combinationthereof. This allows cloud computing environment 50 to offerinfrastructure, platforms, and/or software as services for which a cloudconsumer does not need to maintain resources on a local computingdevice. It is understood that the types of computing devices 54A-N shownin FIG. 2 are intended to be illustrative only and that computing nodes10 and cloud computing environment 50 can communicate with any type ofcomputerized device over any type of network and/or network addressableconnection (e.g., using a web browser).

Referring now to FIG. 3, a set of functional abstraction layers providedby cloud computing environment 50 (FIG. 2) is shown. It should beunderstood in advance that the components, layers, and functions shownin FIG. 3 are intended to be illustrative only and embodiments of theinvention are not limited thereto. As depicted, the following layers andcorresponding functions are provided:

Hardware and software layer 60 includes hardware and softwarecomponents. Examples of hardware components include mainframes. In oneexample, IBM® zSeries® systems and RISC (Reduced Instruction SetComputer) architecture based servers. In one example, IBM pSeries®systems, IBM System X® servers, IBM BladeCenter® systems, storagedevices, networks, and networking components. Examples of softwarecomponents include network application server software. In one example,IBM WebSphere® application server software and database software. In oneexample, IBM DB2® database software. (IBM, zSeries, pSeries, System x,BladeCenter, WebSphere, and DB2 are trademarks of International BusinessMachines Corporation registered in many jurisdictions worldwide.)

Virtualization layer 62 provides an abstraction layer from which thefollowing examples of virtual entities may be provided: virtual servers;virtual storage; virtual networks, including virtual private networks;virtual applications and operating systems; and virtual clients.

In one example, management layer 64 may provide the functions describedbelow. Resource provisioning provides dynamic procurement of computingresources and other resources that are utilized to perform tasks withinthe cloud computing environment. Metering and pricing provide costtracking as resources are utilized within the cloud computingenvironment, and billing or invoicing for consumption of theseresources. In one example, these resources may comprise applicationsoftware licenses. Security provides identity verification for cloudconsumers and tasks, as well as protection for data and other resources.Consumer portal provides access to the cloud computing environment forconsumers and system administrators. Service level management providescloud computing resource allocation and management such that requiredservice levels are met. Service Level Agreement (SLA) planning andfulfillment provides pre-arrangement for, and procurement of, cloudcomputing resources for which a future requirement is anticipated inaccordance with an SLA. Further shown in management layer is firewallcluster management, which represents the functionality that is providedunder the embodiments of the present invention.

Workloads layer 66 provides examples of functionality for which thecloud computing environment may be utilized. Examples of workloads andfunctions which may be provided from this layer include: mapping andnavigation; software development and lifecycle management; virtualclassroom education delivery; data analytics processing; transactionprocessing; and consumer data storage and backup. As mentioned above,all of the foregoing examples described with respect to FIG. 3 areillustrative only, and the invention is not limited to these examples.

It is understood that all functions of the present invention asdescribed herein typically may be performed by the firewall clustermanagement functionality (of management layer 64, which can be tangiblyembodied as modules of program code 42 of program/utility 40 (FIG. 1).However, this need not be the case. Rather, the functionality recitedherein could be carried out/implemented and/or enabled by any of thelayers 60-66 shown in FIG. 3.

It is reiterated that although this disclosure includes a detaileddescription on cloud computing, implementation of the teachings recitedherein are not limited to a cloud computing environment. Rather, theembodiments of the present invention are intended to be implemented withany type of networked computing environment now known or laterdeveloped.

A firewall can either be software-based or hardware-based and is used tohelp keep a network secure. A firewall within a networked computingenvironment provides various network flow control functions, such asinspecting network packets and dropping or rejecting network packetsbased on a set of firewall filtering rules. Firewalls typically performtheir filtering functions by observing communication packets, such asTCP/IP or other network protocol packets, and examining characteristicssuch as the state of the connection. In computing, a stateful firewall(any firewall that performs stateful packet inspection (SPI) or statefulinspection) is a firewall that keeps track of the state of networkconnections traveling across it. Stateful firewalls must be able to seeboth sides of a network conversation in order to properly observe andfilter the connection. The firewall is programmed to distinguishlegitimate packets for different types of connections. Only packetsmatching a known active connection will be allowed by the firewall;others will be rejected (or dropped).

Firewall clustering is typically done locally with firewalls not beingfarther than the reach of an ethernet cable and implemented in redundantpairs. This pairing limits the multi-pathing available in modernnetworks and forces symmetry to Internet protocol (IP) communicationthat is not always easy or efficient to implement on the network. Asnetworks grow and become more complex, alternate paths become viable andthe risk of asymmetric flows breaking across a firewall increases. Whena flow is asymmetric with current firewall technology, it goes in onefirewall pair and out another. The inability of the firewalls to sharestates leads them to receive unexpected packets for unknown sessions.The standard firewall behavior for this condition is to drop the packet.

FIG. 4 depicts an architectural diagram showing asymmetric packet flowin a stateless firewall filter configuration. The diagram includesfirewall pair 402, routers 404A-F, server 406, and firewall pair 408. Asshown, a session initiation packet comes in through firewall pair 402from a client (not shown) along network path 420. Server 406 receivesthe packet and forwards a reply. Router 404B determines a better pathback to the client along network path 422. Firewall pair 408 is unawareof the session and drops the packet at 410.

To work around the issue of packets being dropped, the firewalls aredecoupled from their local pairing and can operate independently acrossgreater distances. The sharing of the state table is done in a way tomaximize the efficiency of memory and central processing unit (CPU)resources on the device. Rather than dropping an unknown packet when itarrives, the firewalls will hold it for a predetermined amount of timeto see if synchronized state information is forthcoming from anotherfirewall in the cluster. If it is not, then the packet is dropped andthe memory space is cleared.

With this arrangement, there may be multiple secure and active paths inthe network with firewalls being able to exchange state information withmultiple pairs or even single firewalls. This allows for maximumflexibility in the network as sites can share Internet or extranetresources typically secured by a firewall in a way that better supportsnetwork load balancing and dynamic failover.

Firewalls register with a centralized cluster synchronization serverthat informs all firewalls in a predefined region of their peers. In oneexample, WAN bandwidth is used to determine optimal firewallregistration paths. Each firewall opens up a communication channel(IP-based) to each of its peer in the region to share state tableinformation. This allows for asymmetrical firewall flows through thenetwork and allows routing protocols to ascertain the best path to agiven destination without having to take firewall placement intoconsideration. Firewalls in a cluster derive a cluster delay interval bymeasuring round-trip time (RTT) through the communication channel. Theprocess of determining the cluster delay interval is described in moredetail below with reference to FIG. 6. Packets received that are allowedby the regional policy (all firewalls must have the same security policyin a given region) but have an unknown or incorrect state are kept inthe firewall's memory until the cluster delay interval is expired. Ifupdated session state information arrives from another firewall in thecluster for the packet, then it is allowed; otherwise, it is droppedonce the cluster delay interval is expired.

Referring now to FIG. 5, an architectural diagram according to anembodiment of the present invention is depicted. The diagram includesfirewall pair 402, routers 404A-F, server 406, firewall pair 408, andcluster synchronization server 412. As shown, a session initiationpacket comes in through firewall pair 402 from a client (not shown)along network path 420. Firewall pair 402 forwards the packet tofirewall cluster synchronization server 412. The firewall clustersynchronization server 412 forwards the state information from firewallpair 402 to all firewalls configured in its region (e.g. firewall pair408). Firewalls in the same region have an Internet protocol (IP)control channel set up to measure latency between them. If firewall pair408 receives a packet with an unknown session state, it will hold thepacket for the duration of the cluster delay interval. The process ofdetermining the cluster delay interval is described in more detail belowwith reference to FIG. 6. Cluster synchronization server 412 receivesthe packet and forwards a reply. Router 404B determines a better pathback to the client along network path 422. Due to state synchronizationacross the region, the session is now known to firewall pair 408 andfirewall pair 408 forwards the packet. Sequence numbers and stateinformation are sent back to the cluster synchronization server 412. Thecluster synchronization server 412 passes session state informationbetween firewall pair 402 and firewall pair 408 for the life of thesession.

FIG. 6 depicts a method flow diagram for determining a cluster delayinterval according to an embodiment of the present invention. At 602, afirewall pair receives region peer information from a clustersynchronization server. At 604, the firewall pair attempts to create acontrol channel to a peer in the region based on the received regionpeer information. If unable to create the control channel, the firewallpair informs the cluster server of the peering issue at 606. In oneexample, the firewall pair informs the cluster server to log the peeringissue. If the control channel is created, the firewall pair sends pingsdown the control channel and measures the round-trip time (RTT) of thepings at 608. Steps 604 through 608 are performed for each peer in theregion. At 610, the longest RTT seen among the peers is used to create acluster delay interval. It should be noted that, in the process flowchart of FIG. 6 described herein, some steps can be added, some stepsmay be omitted, the order of the steps may be rearranged, and/or somesteps may be performed simultaneously.

FIG. 7 depicts an architectural diagram showing a multi-pathing exampleaccording to an embodiment of the present invention. The diagramincludes organization A 702 and organization B 704. Organization A 702includes organization A wide area network (WAN) 710, organization A user740, redundant firewall pairs 740A-B, routers 750A-C, and organization Acluster synchronization server 760. Organization B 704 includesorganization B WAN 712, redundant firewall pairs 770A-B, routers 780A-C,organization B cluster synchronization server 790, and organization Bpartner services server 792.

With each organization having its own firewall clusters and regions,firewall flows may be asymmetric between organization A 702 andorganization B 704. The proposed arrangement allows for dynamic failoverbetween sites or even active/active between two locations (e.g.,location A 720 and location B 722). Routing is now free to choose thebest paths between the sites. For example, a packet from organization Auser 740 takes the shortest network path (i.e., network path 706) toorganization B partner services server 792. Organization B partnerservices server 792 takes the shortest path (i.e., network path 708)back to organization A 702.

The solution is dependent on wide area network (WAN) bandwidth. Routingdepends on a routing metric (e.g., multiple serial digital signal 3s(DS3s) are better than T1). There is a correlation to underlyingbandwidth. If a backup/alternate path is not viable due to bandwidthconstraints, then it may not be used. However, it may be the routingprotocols within the network that determine the network path and forcesymmetry in this case. Multiple paths should be used only if they arecapable of passing the traffic.

FIG. 8 depicts a method flow diagram according to an embodiment of thepresent invention. At 802, a firewall receives a packet between a sourceand a destination with either Synchronize Acknowledge (SYN-ACK) orAcknowledge (ACK) flags set. At 804, the firewall checks a session statetable (or tables) for a session state match. A session state table mayreside on a cluster synchronization server and, in some examples,locally. At 806, a determination is made whether a matching known activeconnection is found between the source and destination. If a match isfound, the packet is forwarded to the destination, and a session stateupdate is sent to the cluster synchronization server at 808. If amatching known active connection is not found, a determination is madewhether the packet received is allowed by the regional policy at 810. Ifnot, the packet is discarded at 812. If the packet is allowed, thefirewall holds the packet in a buffer for the duration of a clusterdelay interval waiting for session state information to arrive at 814. Adecision is made whether the session state information arrives prior tothe expiration of the cluster delay interval at 816. If session stateinformation does not arrive from another firewall in the cluster priorto the expiration of the cluster delay interval, the packet is discardedat 818. If session state information arrives from another firewall inthe cluster prior to the expiration of the cluster delay interval, thepacket is forwarded to the destination, and a session state update issent to the cluster synchronization server at 820. It should be notedthat, in the process flow chart of FIG. 8 described herein, some stepscan be added, some steps may be omitted, the order of the steps may berearranged, and/or some steps may be performed simultaneously.

While shown and described herein as a solution for firewall clustermanagement, it is understood that the invention further provides variousalternative embodiments. For example, in one embodiment, the inventionprovides a computer-readable/useable medium that includes computerprogram code to enable a computer infrastructure to provide identitymanagement functionality as discussed herein. To this extent, thecomputer-readable/useable medium includes program code that implementseach of the various processes of the invention. It is understood thatthe terms computer-readable medium or computer-useable medium compriseone or more of any type of physical embodiment of the program code. Inparticular, the computer-readable/useable medium can comprise programcode embodied on one or more portable storage articles of manufacture(e.g., a compact disc, a magnetic disk, a tape, etc.), on one or moredata storage portions of a computing device, such as memory 28 (FIG. 1)and/or storage system 34 (FIG. 1) (e.g., a fixed disk, a read-onlymemory, a random access memory, a cache memory, etc.).

In another embodiment, the invention provides a method that performs theprocess of the invention on a subscription, advertising, and/or feebasis. That is, a service provider, such as a Solution Integrator, couldoffer to provide firewall cluster management functionality. In thiscase, the service provider can create, maintain, support, etc., acomputer infrastructure, such as computer system 12 (FIG. 1) thatperforms the processes of the invention for one or more consumers. Inreturn, the service provider can receive payment from the consumer(s)under a subscription and/or fee agreement and/or the service providercan receive payment from the sale of advertising content to one or morethird parties.

In still another embodiment, the invention provides acomputer-implemented method for firewall cluster management. In thiscase, a computer infrastructure, such as computer system 12 (FIG. 1),can be provided and one or more systems for performing the processes ofthe invention can be obtained (e.g., created, purchased, used, modified,etc.) and deployed to the computer infrastructure. To this extent, thedeployment of a system can comprise one or more of: (1) installingprogram code on a computing device, such as computer system 12 (FIG. 1)from a computer-readable medium; (2) adding one or more computingdevices to the computer infrastructure; and (3) incorporating and/ormodifying one or more existing systems of the computer infrastructure toenable the computer infrastructure to perform the processes of theinvention.

As used herein, it is understood that the terms “program code” and“computer program code” are synonymous and mean any expression, in anylanguage, code, or notation, of a set of instructions intended to causea computing device having an information processing capability toperform a particular function either directly or after either or both ofthe following: (a) conversion to another language, code, or notation;and/or (b) reproduction in a different material form. To this extent,program code can be embodied as one or more of: an application/softwareprogram, component software/a library of functions, an operating system,a basic device system/driver for a particular computing device, and thelike.

A data processing system suitable for storing and/or executing programcode can be provided hereunder and can include at least one processorcommunicatively coupled, directly or indirectly, to memory elementsthrough a system bus. The memory elements can include, but are notlimited to, local memory employed during actual execution of the programcode, bulk storage, and cache memories that provide temporary storage ofat least some program code in order to reduce the number of times codemust be retrieved from bulk storage during execution. Input/outputand/or other external devices (including, but not limited to, keyboards,displays, pointing devices, etc.) can be coupled to the system eitherdirectly or through intervening device controllers.

Network adapters also may be coupled to the system to enable the dataprocessing system to become coupled to other data processing systems,remote printers, storage devices, and/or the like, through anycombination of intervening private or public networks. Illustrativenetwork adapters include, but are not limited to, modems, cable modems,and Ethernet cards.

The foregoing description of various aspects of the invention has beenpresented for purposes of illustration and description. It is notintended to be exhaustive or to limit the invention to the precise formdisclosed and, obviously, many modifications and variations arepossible. Such modifications and variations that may be apparent to aperson skilled in the art are intended to be included within the scopeof the invention as defined by the accompanying claims.

What is claimed is:
 1. A method for managing a firewall cluster in anetworked computing environment, comprising the computer-implementedsteps of: defining a cluster delay time interval between each firewallpair in a firewall cluster; receiving a packet at a first firewall inthe firewall cluster between a source and a destination, wherein thepacket has an unknown session state; reading a session state table todetermine a session state match based on the source and destination;buffering the packet for the duration of the cluster delay time intervalwhen a session state match is not found; and forwarding the packet tothe destination when session state information is received from a secondfirewall in the firewall cluster prior to the expiration of the clusterdelay time interval.
 2. The method of claim 1, further comprising thecomputer-implemented step of discarding the packet at the first firewallin the firewall cluster when state information is not received prior tothe expiration of the cluster delay time interval.
 3. The method ofclaim 1, further comprising the computer-implemented step of opening acommunication channel between each firewall pair in the firewall clusterand determining a round-trip time (RTT) value between each firewall pairin the firewall cluster using the respective communication channel. 4.The method of claim 3, further comprising the computer-implemented stepof defining the cluster delay time interval based on the highestround-trip time (RTT) value.
 5. The method of claim 4, wherein thecomputer-implemented step of determining a round-trip time (RTT) valuebetween a firewall pair in the firewall cluster comprises pinging thesecond firewall in the firewall pair from the first firewall in thefirewall pair.
 6. The method of claim 1, further comprising thecomputer-implemented step of updating the session state table withsession state information related to the source and destination.
 7. Themethod of claim 1, wherein a solution service provider provides acomputer infrastructure operable to perform for one or more consumers.8. A system for managing a firewall cluster in a networked computingenvironment, comprising: a first firewall in the firewall clusterconfigured to receive a packet from a source intended for a destination,wherein the packet has an unknown session state; a clustersynchronization server configured to store a session state table; thefirst firewall further configured to read the session state table todetermine a session state match based on the source and destination; thefirst firewall further configured to buffer the packet for the durationof a cluster delay time interval when a session state match is notfound, wherein the predefined cluster delay time interval is defined asthe cluster delay time interval between each firewall in a firewallpair; and the first firewall further configured to forward the packet tothe destination when session state information is received from a secondfirewall in the firewall cluster prior to the expiration of the clusterdelay time interval.
 9. The system of claim 8, wherein the firewall isfurther configured to discard the packet when state information is notreceived prior to the expiration of the predefined cluster delay timeinterval.
 10. The system of claim 8, wherein each firewall among theplurality of firewalls is configured to open a communication channelwith each of its peers and determine a round-trip time (RTT) valuebetween itself and each peer using an appropriate communication channel.11. The system of claim 10, wherein the time interval is defined basedon the highest round-trip time (RTT) value.
 12. The system of claim 11,wherein a round-trip time (RTT) value between a firewall pair comprisespinging the second firewall in the firewall pair from the first firewallin the firewall pair.
 13. The system of claim 8, wherein the firewall isfurther configured to update the session state table with session stateinformation related to the source and destination.
 14. The system ofclaim 8, wherein the networked computing environment comprises a cloudcomputing environment.
 15. A computer program product for managing afirewall cluster in a networked computing environment, the computerprogram product comprising a computer readable storage media, andprogram instructions stored on the computer readable storage media, to:define a cluster delay time interval between each firewall pair in afirewall cluster; receive a packet at a first firewall in the firewallcluster between a source and a destination, wherein the packet has anunknown session state; read a session state table to determine a sessionstate match based on the source and destination; buffer the packet forthe duration of the cluster delay time interval when a session statematch is not found; and forward the packet to the destination whensession state information is received from a second firewall in thefirewall cluster prior to the expiration of the cluster delay timeinterval.
 16. The computer program product of claim 15, the computerreadable storage media further comprising instructions to discard thepacket when state information is not received prior to the expiration ofthe cluster delay time interval.
 17. The computer program product ofclaim 15, the computer readable storage media further comprisinginstructions to open a communication channel between each firewall pairand determining a round-trip time (RTT) value between each firewall pairusing an appropriate communication channel.
 18. The computer programproduct of claim 17, the computer readable storage media furthercomprising instructions to define the time interval based on the highestround-trip time (RTT) value.
 19. The computer program product of claim18, the computer readable storage media further comprising instructionsto determine a round-trip time (RTT) value between a firewall paircomprises pinging the second firewall in the firewall pair from thefirst firewall in the firewall pair.
 20. The computer program product ofclaim 15, the computer readable storage media further comprisinginstructions to update the session state table with session stateinformation related to the source and destination.